Stray word (count/court) replaces tool-call opener; call streams as plain <invoke> text and never executes - quantified 13-day local corpus (Opus 4.8)

Summary

Filing to add quantified data to the existing cluster: #64314 #66153 #68354 #64991 #64176 (same failure class, not a new one).

A stray English word ("count" or "court" — one fixed word per session) is emitted exactly where the tool-call opener belongs, followed by non-namespaced <invoke> XML rendered as plain text. Zero tool_use blocks parse, and the call never executes (fail-closed). An identical bare retry almost always succeeds.

Environment

• Claude Code 2.1.187 – 2.1.197 (desktop entrypoint); 2.1.196 currently installed
• Windows 11
• Model: claude-opus-4-8 (verified via the per-message model field in transcripts, not the session setting)

Quantified findings (parsed-JSON audit of local transcripts)

Corpus: 7 main sessions + 453 subagent transcripts, 13 days (2026-06-26 → 2026-07-08), 7,524 tool_use attempts total. All counts below are from a scripted audit of persisted transcript JSON (leaked messages = assistant text blocks containing bare <invoke name="..."> outside code fences), so the corrupted text exists in the API response itself — this is not a client rendering artifact.

1. Variant split — the silent variant is the majority. stop_reason=end_turn (no auto-retry fires; the turn simply ends with the leaked XML as the final output — a silent stall until a human notices) = 43/68 leaked messages. stop_reason=tool_use (harness auto-retry fires) = 25/68. A client-side detector for "final assistant message has zero parsed tool_use blocks but contains bare <invoke name=" could convert the silent majority into the existing auto-retry path.

1. Exposure-normalized model dependence. 68.1 leaks per 1,000 tool_use attempts on the Opus 4.8 main conversation lane (68/998) vs 0/3,276 on Sonnet 4.6 + Fable 5 (+ Haiku subagents) and 0/3,250 on Opus 4.8 subagent lanes in the same corpus. A shared underlying rate is rejected at roughly p≈1e-20 (Poisson). The effect is specific to Opus 4.8 × main lane (long mixed Japanese/English context).

1. Episodic clustering and word stickiness. Leaks arrive in storms: 31, 26, and 11 leaked messages in three sessions, zero in the other four sessions on the same model and client versions. The leak word is sticky per session (court → count → court across sessions; never mixed within one session).

1. Attribution caveat for cross-model reports. Sessions started on Fable 5 can be answered by Opus 4.8 via fallback; every leaked message in this corpus carries model=claude-opus-4-8. Some community reports of this bug on other models may be misattributions — the per-message model field is the reliable signal.

Additional observations: identical bare retry succeeded ~21/23 with no double-execution observed for this leak morphology; cache_read at leak time ranged 29k–920k tokens, including one leak on the first message of a fresh session — long context is not a necessary condition.

Suggested mitigations (ordered by expected impact)

1. Client: treat "final assistant message contains bare <invoke name= outside code fences AND zero parsed tool_use blocks" as malformed-tool-use and route it into the existing auto-retry path. This single check converts the silent end_turn majority (43/68 here) into the already-working recovery flow. (The shipped client appears to already have a default-off clean-retry path for malformed tool use; extending/enabling it for the end_turn morphology would cover this.)
2. Model/serving: constrain decoding of the tool-call opener token (grammar/format-constrained sampling at the tool-use boundary) on Opus 4.8. The stable two-word leak vocabulary (count/court, prefix "cou") and the retry-fixes-it behavior both point to a near-neighbor token missample at a single boundary position.
3. Telemetry cross-check: the concentration reported here (Opus 4.8 × main conversation lane; zero in subagent lanes and other models) should be reproducible in server-side telemetry and may localize the regression quickly.

No response needed — filing to add reproducible quantitative data to the cluster.

Sanitized JSONL excerpts are available on request after a separate sanitization review.